Lista CVE - 2020 / Ottobre
Visualizzazione 1201 - 1300 di 1594 CVE per Ottobre 2020 (Pagina 13 di 16)
| ID CVE | Data | Titolo |
|---|---|---|
| CVE-2020-18129 | 2020-10-22 | A CSRF vulnerability in Eyoucms v1.2.7 allows an attacker to add an admin account via login.php. |
| CVE-2019-17007 | 2020-10-22 | In Network Security Services before 3.44, a malformed Netscape Certificate Sequence can cause NSS to crash, resulting in a denial of service. |
| CVE-2020-15684 | 2020-10-22 | Mozilla developers reported memory safety bugs present in Firefox 81. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could... |
| CVE-2020-15683 | 2020-10-22 | Mozilla developers and community members reported memory safety bugs present in Firefox 81 and Firefox ESR 78.3. Some of these bugs showed evidence of memory corruption and we presume that... |
| CVE-2020-15682 | 2020-10-22 | When a link to an external protocol was clicked, a prompt was presented that allowed the user to choose what application to open it in. An attacker could induce that... |
| CVE-2020-15681 | 2020-10-22 | When multiple WASM threads had a reference to a module, and were looking up exported functions, one WASM thread could have overwritten another's entry in a shared stub table, resulting... |
| CVE-2020-15680 | 2020-10-22 | If a valid external protocol handler was referenced in an image tag, the resulting broken image size could be distinguished from a broken image size of a non-existent protocol handler.... |
| CVE-2020-27675 | 2020-10-22 | An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. drivers/xen/events/events_base.c allows event-channel removal during the event-handling loop (a race condition). This can cause... |
| CVE-2020-27674 | 2020-10-22 | An issue was discovered in Xen through 4.14.x allowing x86 PV guest OS users to gain guest OS privileges by modifying kernel memory contents, because invalidation of TLB entries is... |
| CVE-2020-27673 | 2020-10-22 | An issue was discovered in the Linux kernel through 5.9.1, as used with Xen through 4.14.x. Guest OS users can cause a denial of service (host OS hang) via a... |
| CVE-2020-27672 | 2020-10-22 | An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a host OS denial of service, achieve data corruption, or possibly gain privileges by exploiting... |
| CVE-2020-27671 | 2020-10-22 | An issue was discovered in Xen through 4.14.x allowing x86 HVM and PVH guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly... |
| CVE-2020-27670 | 2020-10-22 | An issue was discovered in Xen through 4.14.x allowing x86 guest OS users to cause a denial of service (data corruption), cause a data leak, or possibly gain privileges because... |
| CVE-2020-11853 | 2020-10-22 | Arbitrary code execution vulnerability on multiple Micro Focus products |
| CVE-2020-15270 | 2020-10-22 | Improper session expiration in Parse Server |
| CVE-2020-27216 | 2020-10-23 | In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system.... |
| CVE-2018-8062 | 2020-10-23 | A cross-site scripting (XSS) vulnerability on Comtrend AR-5387un devices with A731-410JAZ-C04_R02.A2pD035g.d23i firmware allows remote attackers to inject arbitrary web script or HTML via the Service Description parameter while creating a... |
| CVE-2019-14711 | 2020-10-23 | Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have a race condition for RBAC bypass. |
| CVE-2019-14712 | 2020-10-23 | Verifone VerixV Pinpad Payment Terminals with QT000530 allow bypass of integrity and origin control for S1G file generation. |
| CVE-2019-14713 | 2020-10-23 | Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow installation of unsigned packages. |
| CVE-2019-14719 | 2020-10-23 | Verifone MX900 series Pinpad Payment Terminals with OS 30251000 allow multiple arbitrary command injections, as demonstrated by the file manager. |
| CVE-2019-14718 | 2020-10-23 | Verifone MX900 series Pinpad Payment Terminals with OS 30251000 have Insecure Permissions, with resultant svc_netcontrol arbitrary command injection and privilege escalation. |
| CVE-2019-14717 | 2020-10-23 | Verifone Verix OS on VerixV Pinpad Payment Terminals with QT000530 have a Buffer Overflow via the Run system call. |
| CVE-2019-14716 | 2020-10-23 | Verifone VerixV Pinpad Payment Terminals with QT000530 have an undocumented physical access mode (aka VerixV shell.out). |
| CVE-2020-9361 | 2020-10-23 | CryptoPro CSP through 5.0.0.10004 on 64-bit platforms allows local users with the SeChangeNotifyPrivilege right to cause denial of service because user-mode input is mishandled during process creation. |
| CVE-2020-9331 | 2020-10-23 | CryptoPro CSP through 5.0.0.10004 on 32-bit platforms allows Local Privilege Escalation (by local users with the SeChangeNotifyPrivilege right) because user-mode input is mishandled during process creation. An attacker can write... |
| CVE-2020-15002 | 2020-10-23 | OX App Suite through 7.10.3 allows SSRF via the the /ajax/messaging/message message API. |
| CVE-2020-15003 | 2020-10-23 | OX App Suite through 7.10.3 allows Information Exposure because a user can obtain the IP address and User-Agent string of a different user (via the session API during shared Drive... |
| CVE-2020-15004 | 2020-10-23 | OX App Suite through 7.10.3 allows stats/diagnostic?param= XSS. |
| CVE-2020-26887 | 2020-10-23 | FRITZ!OS before 7.21 on FRITZ!Box devices allows a bypass of a DNS Rebinding protection mechanism. |
| CVE-2019-14715 | 2020-10-23 | Verifone Pinpad Payment Terminals allow undocumented physical access to the system via an SBI bootloader memory write operation. |
| CVE-2020-26561 | 2020-10-23 | Belkin LINKSYS WRT160NL 1.0.04.002_US_20130619 devices have a stack-based buffer overflow vulnerability because of sprintf in create_dir in mini_httpd. Successful exploitation leads to arbitrary code execution. NOTE: This vulnerability only affects... |
| CVE-2020-3997 | 2020-10-23 | VMware Horizon Server (7.x prior to 7.10.3 or 7.13.0) contains a Cross Site Scripting (XSS) vulnerability. Successful exploitation of this issue may allow an attacker to inject malicious script which... |
| CVE-2020-3998 | 2020-10-23 | VMware Horizon Client for Windows (5.x prior to 5.5.0) contains an information disclosure vulnerability. A malicious attacker with local privileges on the machine where Horizon Client for Windows is installed... |
| CVE-2020-25466 | 2020-10-23 | A SSRF vulnerability exists in the downloadimage interface of CRMEB 3.0, which can remotely download arbitrary files on the server and remotely execute arbitrary code. |
| CVE-2020-25483 | 2020-10-23 | An arbitrary command execution vulnerability exists in the fopen() function of file writes of UCMS v1.4.8, where an attacker can gain access to the server. |
| CVE-2020-5977 | 2020-10-23 | NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in NVIDIA Web Helper NodeJS Web Server in which an uncontrolled search path is used to load a node... |
| CVE-2020-5978 | 2020-10-23 | NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in its services in which a folder is created by nvcontainer.exe under normal user login with LOCAL_SYSTEM privileges which... |
| CVE-2020-5990 | 2020-10-23 | NVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in the ShadowPlay component which may lead to local privilege escalation, code execution, denial of service or information disclosure. |
| CVE-2020-24847 | 2020-10-23 | A Cross-Site Request Forgery (CSRF) vulnerability is identified in FruityWifi through 2.4. Due to a lack of CSRF protection in page_config_adv.php, an unauthenticated attacker can lure the victim to visit... |
| CVE-2020-24848 | 2020-10-23 | FruityWifi through 2.4 has an unsafe Sudo configuration [(ALL : ALL) NOPASSWD: ALL]. This allows an attacker to perform a system-level (root) local privilege escalation, allowing an attacker to gain... |
| CVE-2020-27388 | 2020-10-23 | Multiple Stored Cross Site Scripting (XSS) vulnerabilities exist in the YOURLS Admin Panel, Versions 1.5 - 1.7.10. An authenticated user must modify a PHP plugin with a malicious payload and... |
| CVE-2020-27678 | 2020-10-23 | An issue was discovered in illumos before 2020-10-22, as used in OmniOS before r151030by, r151032ay, and r151034y and SmartOS before 20201022. There is a buffer overflow in parse_user_name in lib/libpam/pam_framework.c. |
| CVE-2020-7751 | 2020-10-25 | Prototype Pollution |
| CVE-2020-25470 | 2020-10-26 | AntSword 2.1.8.1 contains a cross-site scripting (XSS) vulnerability in the View Site funtion. When viewing an added site, an XSS payload can be injected in cookies view which can lead... |
| CVE-2020-13100 | 2020-10-26 | Arista’s CloudVision eXchange (CVX) server before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause a denial of service (crash and restart) in... |
| CVE-2020-7196 | 2020-10-26 | The HPE BlueData EPIC Software Platform version 4.0 and HPE Ezmeral Container Platform 5.0 use an insecure method of handling sensitive Kerberos passwords that is susceptible to unauthorized interception and/or... |
| CVE-2020-7197 | 2020-10-26 | SSMC3.7.0.0 is vulnerable to remote authentication bypass. HPE StoreServ Management Console (SSMC) 3.7.0.0 is an off node multiarray manager web application and remains isolated from data on the managed arrays.... |
| CVE-2020-15897 | 2020-10-26 | Arista EOS before 4.21.12M, 4.22.x before 4.22.7M, 4.23.x before 4.23.5M, and 4.24.x before 4.24.2F allows remote attackers to cause traffic loss or incorrect forwarding of traffic via a malformed link-state... |
| CVE-2020-24631 | 2020-10-26 | A remote execution of arbitrary commands vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2. |
| CVE-2020-24632 | 2020-10-26 | A remote execution of arbitrary commandss vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2. |
| CVE-2020-7124 | 2020-10-26 | A remote unauthorized access vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2. |
| CVE-2020-7125 | 2020-10-26 | A remote escalation of privilege vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2. |
| CVE-2020-7126 | 2020-10-26 | A remote server-side request forgery (ssrf) vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2. |
| CVE-2020-7127 | 2020-10-26 | A remote unauthenticated arbitrary code execution vulnerability was discovered in Aruba Airwave Software version(s): Prior to 1.3.2. |
| CVE-2020-18766 | 2020-10-26 | A cross-site scripting (XSS) vulnerability AntSword v2.0.7 can remotely execute system commands. |
| CVE-2020-6876 | 2020-10-26 | A ZTE product is impacted by an XSS vulnerability. The vulnerability is caused by the lack of correct verification of client data in the WEB module. By inserting malicious scripts... |
| CVE-2020-27187 | 2020-10-26 | An issue was discovered in KDE Partition Manager 4.1.0 before 4.2.0. The kpmcore_externalcommand helper contains a logic flaw in which the service invoking D-Bus is not properly checked. An attacker... |
| CVE-2020-7752 | 2020-10-26 | Command Injection |
| CVE-2020-26161 | 2020-10-26 | In Octopus Deploy through 2020.4.2, an attacker could redirect users to an external site via a modified HTTP Host header. |
| CVE-2020-26566 | 2020-10-26 | A Denial of Service condition in Motion-Project Motion 3.2 through 4.3.1 allows remote unauthenticated users to cause a webu.c segmentation fault and kill the main process via a crafted HTTP... |
| CVE-2017-18925 | 2020-10-26 | opentmpfiles through 0.3.1 allows local users to take ownership of arbitrary files because d entries are mishandled and allow a symlink attack. |
| CVE-2020-15271 | 2020-10-26 | Shell Command Execution in lookatme |
| CVE-2020-15272 | 2020-10-26 | Shell-injection in git-tag-annotation GitHub action |
| CVE-2020-15274 | 2020-10-26 | Stored XSS via search result in Wiki.js |
| CVE-2020-25034 | 2020-10-26 | eMPS prior to eMPS 9.0 FireEye EX 3500 devices allows remote authenticated users to conduct SQL injection attacks via the sort, sort_by, search{URL], or search[attachment] parameter to the email search... |
| CVE-2020-26878 | 2020-10-26 | Ruckus through 1.5.1.0.21 is affected by remote command injection. An authenticated user can submit a query to the API (/service/v1/createUser endpoint), injecting arbitrary commands that will be executed as root... |
| CVE-2020-26879 | 2020-10-26 | Ruckus vRioT through 1.5.1.0.21 has an API backdoor that is hardcoded into validate_token.py. An unauthenticated attacker can interact with the service API by using a backdoor value as the Authorization... |
| CVE-2020-1915 | 2020-10-26 | An out-of-bounds read in the JavaScript Interpreter in Facebook Hermes prior to commit 8cb935cd3b2321c46aa6b7ed8454d95c75a7fca0 allows attackers to cause a denial of service attack or possible further memory corruption via crafted... |
| CVE-2020-27743 | 2020-10-26 | libtac in pam_tacplus through 1.5.1 lacks a check for a failure of RAND_bytes()/RAND_pseudo_bytes(). This could lead to use of a non-random/predictable session_id. |
| CVE-2018-21269 | 2020-10-27 | checkpath in OpenRC through 0.42.1 might allow local users to take ownership of arbitrary files because a non-terminal path component can be a symlink. |
| CVE-2020-15352 | 2020-10-27 | An XML external entity (XXE) vulnerability in Pulse Connect Secure (PCS) before 9.1R9 and Pulse Policy Secure (PPS) before 9.1R9 allows remote authenticated admins to conduct server-side request forgery (SSRF)... |
| CVE-2020-8956 | 2020-10-27 | Pulse Secure Desktop Client 9.0Rx before 9.0R5 and 9.1Rx before 9.1R4 on Windows reveals users' passwords if Save Settings is enabled. |
| CVE-2020-27180 | 2020-10-27 | konzept-ix publiXone before 2020.015 allows attackers to download files by iterating over the IXCopy fileID parameter. |
| CVE-2020-27181 | 2020-10-27 | A hardcoded AES key in CipherUtils.java in the Java applet of konzept-ix publiXone before 2020.015 allows attackers to craft password-reset tokens or decrypt server-side configuration files. |
| CVE-2020-27182 | 2020-10-27 | Multiple cross-site scripting (XSS) vulnerabilities in konzept-ix publiXone before 2020.015 allow remote attackers to inject arbitrary JavaScript or HTML via appletError.jsp, job_jacket_detail.jsp, ixedit/editor_component.jsp, or the login form. |
| CVE-2020-27183 | 2020-10-27 | A RemoteFunctions endpoint with missing access control in konzept-ix publiXone before 2020.015 allows attackers to disclose sensitive user information, send arbitrary e-mails, escalate the privileges of arbitrary user accounts, and... |
| CVE-2020-27179 | 2020-10-27 | konzept-ix publiXone before 2020.015 allows attackers to take over arbitrary user accounts by crafting password-reset tokens. |
| CVE-2020-7753 | 2020-10-27 | Regular Expression Denial of Service (ReDoS) |
| CVE-2020-23864 | 2020-10-27 | An issue exits in IOBit Malware Fighter version 8.0.2.547. Local escalation of privileges is possible by dropping a malicious DLL file into the WindowsApps folder. |
| CVE-2020-10256 | 2020-10-27 | An issue was discovered in beta versions of the 1Password command-line tool prior to 0.5.5 and in beta versions of the 1Password SCIM bridge prior to 0.7.3. An insecure random... |
| CVE-2020-8579 | 2020-10-27 | Clustered Data ONTAP versions 9.7 through 9.7P7 are susceptible to a vulnerability which allows an attacker with access to an intercluster LIF to cause a Denial of Service (DoS). |
| CVE-2020-6022 | 2020-10-27 | Check Point ZoneAlarm before version 15.8.139.18543 allows a local actor to delete arbitrary files while restoring files in Anti-Ransomware. |
| CVE-2020-6023 | 2020-10-27 | Check Point ZoneAlarm before version 15.8.139.18543 allows a local actor to escalate privileges while restoring files in Anti-Ransomware. |
| CVE-2020-23945 | 2020-10-27 | A SQL injection vulnerability exists in Victor CMS V1.0 in the cat_id parameter of the category.php file. This parameter can be used by sqlmap to obtain data information in the... |
| CVE-2020-7754 | 2020-10-27 | Regular Expression Denial of Service (ReDoS) |
| CVE-2020-11854 | 2020-10-27 | Arbitrary code execution vlnerability in Operation bridge Manager, Application Performance Management and Operations Bridge (containerized) products. |
| CVE-2020-11858 | 2020-10-27 | Code execution with escalated privilegesn vlnerability in Operation bridge Manager and Operations Bridge (containerized) products. |
| CVE-2020-7755 | 2020-10-27 | Regular Expression Denial of Service (ReDoS) |
| CVE-2020-27853 | 2020-10-27 | Wire before 2020-10-16 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a format string. This affects Wire AVS (Audio, Video, and... |
| CVE-2020-15238 | 2020-10-27 | Local privilege escalation Blueman |
| CVE-2018-4296 | 2020-10-27 | This issue is fixed in macOS Mojave 10.14. A permissions issue existed in DiskArbitration. This was addressed with additional ownership checks. |
| CVE-2018-4339 | 2020-10-27 | This issue was addressed with a new entitlement. This issue is fixed in iOS 12.1. A local user may be able to read a persistent device identifier. |
| CVE-2018-4390 | 2020-10-27 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan,... |
| CVE-2018-4381 | 2020-10-27 | A resource exhaustion issue was addressed with improved input validation. This issue is fixed in tvOS 12.1, iOS 12.1. Processing a maliciously crafted message may lead to a denial of... |
| CVE-2018-4428 | 2020-10-27 | A lock screen issue allowed access to the share function on a locked device. This issue was addressed by restricting options offered on a locked device. This issue is fixed... |
| CVE-2018-4391 | 2020-10-27 | An inconsistent user interface issue was addressed with improved state management. This issue is fixed in macOS High Sierra 10.13.1, Security Update 2017-001 Sierra, and Security Update 2017-004 El Capitan,... |
| CVE-2018-4444 | 2020-10-27 | A logic issue was addressed with improved state management. This issue is fixed in Safari 12.0.2, iOS 12.1.1, tvOS 12.1.1, iTunes 12.9.2 for Windows. Processing maliciously crafted web content may... |
| CVE-2018-4433 | 2020-10-27 | A configuration issue was addressed with additional restrictions. This issue is fixed in macOS Mojave 10.14.4, Security Update 2019-002 High Sierra, Security Update 2019-002 Sierra, watchOS 5, iOS 12, tvOS... |
| CVE-2018-4451 | 2020-10-27 | This issue is fixed in macOS Mojave 10.14. A memory corruption issue was addressed with improved input validation. |